TechSpot

540.filost.com

By tm872110
Feb 26, 2007
  1. I have tried virus detectors and spyware detection programs, but a lot of times when I open up Internet Explorer, I get a popup from 540.filost.com. This is my HijackThis log. Also (I apologize if this is the wrong board for this question), but I have recently reinstalled Norton AntiVirus, and now have that and AOL Safety and Security Center installed, which provides virus, firewall, and spyware protection. I would like to remove it, and want to know if Ad-Aware and Windows Firewall are good alternatives.
     
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Hello and welcome to Techspot.

    Your system is infected with quite a few nasties.

    Very Important: Before deciding whether you should clean or reformat your system, go and read this thread HERE and decide what it is you want to do.

    If after reading the above, you wish to clean your system, do the following.

    Go and read the Viruses/Spyware/Malware, preliminary removal instructions. Follow all the instructions exactly.

    Post fresh HJT and AVG Antispyware logs as attachments into this thread, only after doing the above.

    Regards Howard :wave: :wave:

    This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  3. tm872110

    tm872110 TS Rookie Topic Starter Posts: 41

    I have done everything in the preliminary instructions and still get popups from 540.filost.com/randomsites/banner.aspx. I have attached my new HJT log.
     
  4. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    You didn`t attach an AVG Antispyware log as requested. Please do so in your next reply.

    Download the Pocket Killbox programme from HERE. Extract it but don`t run it yet.

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

    Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

    Go to add remove programmes in your control panel and uninstall anything to do with(if there).

    PartyGaming
    PartyPoker

    Close control panel.

    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).

    RunApp.exe

    Close task manager.

    Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)

    O3 - Toolbar: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - (no file)

    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe

    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe

    O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab

    O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab

    O16 - DPF: {33331111-1111-1111-1111-622221193458} - file://c:\ex.cab

    O16 - DPF: {43331111-1111-1111-1111-611111195622} - file://c:\ex.cab

    O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab

    O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/4058/ftp.coupons.com/r3302/Unilever/Coupons.ca b

    O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - C:\WINDOWS\System32\vbsys2.dll

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or directories(if there).

    c:\ex.cab
    c:\eied_s7.cab
    C:\Program Files\PartyGaming<Delete the entire folder.

    Run the killbox.exe file. When it loads type the full path to the file you would like to delete in the field and check the delete file on reboot button. press the Delete File button (looks like a red circle with a white X). It will prompt you to reboot, select no until you have finished inputting the files you want to delete, only then allow it to reboot and hopefully your files will now be deleted. If your computer doesn`t automatically restart, restart it manually.

    This is the filepath you need to enter into killbox.

    C:\WINDOWS\System32\vbsys2.dll

    Once your system has rebooted, rehide your protected OS files.

    Post a fresh HJT log as well as an AVG Antispyware log.

    Regards Howard :)

    This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  5. tm872110

    tm872110 TS Rookie Topic Starter Posts: 41

    Is PartyPoker adware or a virus? I've had it on my computer for about one and a half years, and have never experienced any problems with it. I have only recently experienced the problems with vbsys2.dll and 540.filost.com.
     
  6. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    PartyPoker and more specifically the RunApp.exe file is classed as adware. See HERE for more info. It is of course upto you if you want to keep it or not.

    Regards Howard :)

    This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  7. tm872110

    tm872110 TS Rookie Topic Starter Posts: 41

    I couldn't remove the PartyGaming file while in Safe Mode, and I believe the KillBox program created a folder called '!KillBox' on my C drive, which contains the vbsys2.dll file. Do I need to delete that file? Also, here is my HJT and AVG log.
     
  8. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    All the items in your AVG Antispyware log are ignored. You need to do a fresh scan with AVG Antispyware and set the programme to quarantine the results as per the instructions in this thread HERE. For a guide to using AVG Antispyware, look HERE.

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

    Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).

    setup.exe
    regsvr32.exe
    silent_ventura5.exe

    Close task manager.

    Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    O4 - HKLM\..\Run: [AOLSSCASPUpgrade] C:\Documents and Settings\Miller's\Local Settings\Temp\ssc_asp_upgrade_1.1.3.4\setup.exe

    O4 - HKCU\..\RunOnce: [SSCSUD] regsvr32.exe /S

    O9 - Extra button: (no name) - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)

    O9 - Extra 'Tools' menuitem: Java - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or directories(if there).

    C:\Documents and Settings\Miller's\Local Settings\Temp\ssc_asp_upgrade_1.1.3.4\setup.exe

    C:\WINDOWS\system32\silent_ventura5.exe

    Reboot into normal mode and rehide your protected OS files.

    Post fresh HJT and AVG Antispyware logs.

    Regards Howard :)

    This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  9. tm872110

    tm872110 TS Rookie Topic Starter Posts: 41

    What should I do with the '!KillBox' file that was created on my computer which contains the vbsys2.dll file in it?
     
  10. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    You can delete the Killbox backups file.

    Regards Howard :)

    This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  11. tm872110

    tm872110 TS Rookie Topic Starter Posts: 41

    Sorry, just making sure. All the files in my AVG log are files that I do not need, right? I remember trying to remove things with Ad-Aware a few years ago, and messed up my Internet Explorer.
     
  12. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Yes, the files in AVG can be safely removed. In fact it is definitely a good idea to get rid of them as they are not good. That`s why I always ask that items be quarantined, rather than deleted/ignored. That way I can see what needs getting rid of and anything that needs to be kept.

    Ignore the files in the C:\System Volume Information\_restore for now as we`ll deal with them separately.

    Regards Howard :)

    This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  13. tm872110

    tm872110 TS Rookie Topic Starter Posts: 41

    I removed the files, and quarantined the the files that weren't in C:\System Volume Information\_restore, but the program wouldn't let me quarantine the TrackingCookie.2o7 file. Should I just delete that one? Also, I have attached my HJT and AVG logs.
     
  14. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Your HJT log is now clean.

    Delete all files in AVG Antispyware quarantine.

    Run the Ccleaner programme as per the instructions in this thread HERE.

    You can safely delete the TrackingCookie.2o7, if Ccleaner doesn`t get rid of it for you.

    Turn off system restore.(XP/ME only) See how HERE.

    Now, turn system restore back on. This will have deleted all your old restore points and any nasties that are in them. It will also have created a new, clean restore point.

    If you have any further virus/spyware problems, please post in this thread.

    Regards Howard :)

    This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  15. tm872110

    tm872110 TS Rookie Topic Starter Posts: 41

    I didn't realize I had those other things on the computer. Thanks for your help! Can I remove files such as KillBox, HJT, AVG, and CCleaner, or should I leave them?
     
  16. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Keep AVG Antispyware and Ccleaner, both are very good programmes and Ccleaner is especially useful for removing temp files etc.

    You can get rid of HJT and Killbox, including any Killbox backups.

    Regards Howard :)

    This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  17. tm872110

    tm872110 TS Rookie Topic Starter Posts: 41

    Okay, but one more question. CCleaner removed the most viewed documents in the Start menu. How do I turn that back on?
     
  18. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Run Ccleaner and click on the Windows tab. Untick Recent documents. Close Ccleaner.

    Regards Howard :)

    This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  19. tm872110

    tm872110 TS Rookie Topic Starter Posts: 41

    I found two objects in Ad-Aware that didn't show up in AVG. Are they anything to worry about?
     
  20. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Nothing to worry about there. I take it you had Ad-Aware fix the entries?

    Regards Howard :)

    This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  21. tm872110

    tm872110 TS Rookie Topic Starter Posts: 41

    No, is that what I should do? I didn't want to do anything with them because I didn't know what they were.
     
  22. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    You should have Ad-Aware fix those entries.

    Taken from HERE.

    Regards Howard :)

    This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  23. tm872110

    tm872110 TS Rookie Topic Starter Posts: 41

    I didn't see an option to fix the entries, so I quarantined them, and have not seen any problems.
     
  24. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    In that case, run Ad-Aware and click on the padlock icon, delete whatever is in quarantine.

    Regards Howard :)

    This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  25. tm872110

    tm872110 TS Rookie Topic Starter Posts: 41

    Okay (sorry about all of this), I just scanned my computer with Spybot and found these entries, after scanning with Ad-Aware and finding nothing at all. I don't know how to create a Spybot log, so I'll list the file names.

    Accoona
    CAS-Client
    eAcceleration
    Microsoft.WindowsSecurityCenter.AntiVirusOverride
    Virtual Bouncer
    Web-Nexus

    What do you recommend that I do with these files?
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...